Rapid7 Details Microsoft SharePoint JWT Authentication Bypass (CVE-2026-55040)
Rapid7 has published a technical analysis and proof-of-concept for CVE-2026-55040, a critical authentication bypass in Microsoft SharePoint Server Subscription Edition that allows remote attackers to impersonate any user.
Rapid7 has released a detailed technical analysis of CVE-2026-55040, a critical authentication bypass vulnerability affecting Microsoft SharePoint Server Subscription Edition. The vulnerability, initially disclosed in coordination with Microsoft on July 14, 2026, allows a remote, unauthenticated attacker to forge a valid JSON Web Token (JWT) and gain unauthorized access as any user on a vulnerable SharePoint server.
The core of the exploit lies within a chain of four distinct weaknesses identified in SharePoint's JWT token validation pipeline, specifically within the SPJsonWebSecurityTokenHandlerV2 class and its base class SPJsonWebSecurityBaseTokenHandlerV2. These classes are responsible for parsing and validating Bearer service-to-service (S2S) tokens used in SharePoint's authentication mechanisms.
One of the most significant flaws is the explicit disabling of signature verification. The SPJsonWebSecurityTokenHandlerV2 class sets RequireSignedTokens to false during token validation. This setting bypasses the JWT library's cryptographic signature checks, allowing tokens with an alg: none header to be accepted without cryptographic validation. This effectively removes a fundamental security layer for JWTs.
Further weaknesses exploit the nested JWT structure used by SharePoint. The outer token contains user identity claims, while an inner "actor token" is embedded within the actortoken claim. This actor token is intended to represent the calling application and must be cryptographically signed by a trusted certificate. However, the validation process exhibits additional vulnerabilities that allow an attacker to manipulate or bypass these checks.
Specifically, the analysis points to issues in how the inner actor token's signature is validated. By chaining these JWT validation weaknesses, an attacker can craft a malicious token that the SharePoint server will accept as legitimate, granting them the privileges of any user, including administrators. The proof-of-concept (PoC) script provided by Rapid7 demonstrates the feasibility of this attack.
The vulnerability affects SharePoint Server Subscription Edition version 16.0.19725.20210. While Microsoft has addressed this vulnerability, the detailed technical breakdown by Rapid7 provides crucial insights for security professionals to understand the attack vector and enhance their defenses against similar authentication bypass techniques.
This discovery underscores the persistent threat of authentication bypass vulnerabilities in complex enterprise software. Organizations relying on SharePoint are urged to ensure they have applied all relevant security updates to mitigate the risk of exploitation. The detailed analysis serves as a valuable resource for understanding the intricacies of JWT validation and the potential pitfalls in its implementation.
This new report from Rapid7 details a second vulnerability, CVE-2026-63520, which when chained with CVE-2026-55040, creates a critical unauthenticated remote code execution exploit chain against Microsoft SharePoint. The RCE vulnerability stems from an unsafe .NET type instantiation in Business Connectivity Services and affects SharePoint, Project Server, and Office Web Apps Server, while the previously disclosed CVE-2026-55040 only impacts SharePoint.